Bookly WordPress plugin vulnerabilities

The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total. This allows unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details. This allows unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.

The Bookly plugin for WordPress (versions up to and including 28.2) is vulnerable to Authorization Bypass via PHP Type Juggling. Due to the use of a loose inequality operator in the verification function and lack of CSRF and authentication protection in the AJAX controller, an unauthenticated attacker can bypass phone/email ownership verification and overwrite any Bookly customer's data.